wtclaude
e34284561f
docs(android): add trusted-devices/MFA live smoke-test screenshots Live end-to-end smoke test of the Android trusted-device + recovery-code feature (app PR RunicGateway/Android-app#23) against the local server + MariaDB on an API 36 emulator. Adds android/screenshots/ with five captures (login trust step, account Security section, Trusted Devices, recovery-codes show-once, recovery-code login) and a README documenting the verified flows — including that trust survives logout (password-only re-login skipped TOTP) and untrust-all clears the local token. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr @
Android app — trusted devices & recovery codes (live smoke test)
Screenshots from a live end-to-end smoke test of the trusted-device + MFA feature on
the Android client (app PR RunicGateway/Android-app#23), captured against the local
Node server (127.0.0.1:3000) and a uomysticmoon MariaDB, on an API 36 emulator.
See ../PLAN.md §4.1.1 for the design and ../../website/TRUSTED_DEVICES_MFA.md for
the canonical contract.
| # | Screenshot | Shows |
|---|---|---|
| 1 | 01-login-2fa-trust-device.png |
The 401 { totpRequired } login step: the authentication code field, the "Use a recovery code instead" toggle, and the "Trust this device (skip codes for 30 days)" checkbox (ticked). |
| 2 | 02-account-security-section.png |
The new Security section on the account screen linking to Trusted devices and Recovery codes. |
| 3 | 03-trusted-devices.png |
The Trusted Devices screen listing this device (Google sdk_gphone64_x86_64 — the device_name sent at login) with revoke / trust-this-device / untrust-all. |
| 4 | 04-recovery-codes-show-once.png |
The Recovery Codes screen after a password-stepped regenerate: the one-time batch shown once with copy / share, and the updated remaining count. |
| 5 | 05-recovery-code-login.png |
Signing in with a single-use recovery code instead of the authenticator code. |
Verified flows (all passed)
- 2FA login + "Trust this device" →
200, trust token stored; server loggeddevice trusted. - Trust survives logout — after signing out, a password-only sign-in skipped the
TOTP step entirely (server: a clean
200with no preceding401 totpRequired). This is the headline behaviour: the trust token is only consulted at a fresh login, so it must outlive logout (see PLAN §4.1.1). - Trusted Devices — list, and the device's
last_usedstamp advancing after the trust-skip login. - Untrust all — cleared the server rows and the local token; the next
password-only sign-in correctly required the TOTP step again (server:
401). - Recovery codes — generate (password step-up, shown once) and a successful
recovery-code login (server:
mobile login via recovery code→200).